proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-06-13 17:49:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

lib: fix infinite loop in __darr_in_vsprintf

Browse Source 
`darr_avail` returns the available capacity excluding the already
existing terminating NULL byte. Take this into account when using
`darr_avail`. Otherwise, if the error length is a power of 2, the
capacity is never enough and the function stucks in an infinite loop.

Signed-off-by: Igor Ryzhov <iryzhov@nfware.com>
(cherry picked from commit cb6032d6b3)
This commit is contained in:
Igor Ryzhov 2024-03-04 20:41:41 +02:00 committed by Mergify
parent e5da17897c
commit f23f58a6a4
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/darr.c
View File

@ -70,11 +70,11 @@ char *__darr_in_vsprintf(char **sp, bool concat, const char *fmt, va_list ap)
*darr_append(*sp) = 0;
again:
va_copy(ap_copy, ap);
len = vsnprintf(darr_last(*sp), darr_avail(*sp), fmt, ap_copy);
len = vsnprintf(darr_last(*sp), darr_avail(*sp) + 1, fmt, ap_copy);
va_end(ap_copy);
if (len < 0)
darr_in_strcat(*sp, fmt);
else if ((size_t)len < darr_avail(*sp))
else if ((size_t)len <= darr_avail(*sp))
_darr_len(*sp) += len;
else {
darr_ensure_cap(*sp, darr_len(*sp) + (size_t)len);